エピソード

  • Security for Non-Security People
    2026/10/20
    This year, host Bryan Mills has cleaned up multiple hacked WordPress sites, including one where a single outdated plugin handed the attacker a file manager: open any file, write straight to the database. Here's what the attacker knew about that organization before striking: nothing. A bot read a version number, and that was the whole crime.This episode is security with no dread and no jargon: four ordinary enemies, one afternoon of defenses, and a calm script for the bad day the defenses make unlikely. Bryan names the four attacks small sites actually face, brute force, malware through outdated software, AI-quality phishing, and form spam, and, just as usefully, the exotic threats you have permission to ignore. Then the baseline, nearly all of it free: the update schedule as the highest-value security control you hold, unique vaulted passwords, two-factor authentication on every account that could cause an incident, the one habit that defeats phishing even when the fake is perfect (never log in through a link in a message), and least privilege, including why publishing should never happen from an account that can delete the site. Then the walls and alarms, tuned rare enough to matter, and the hour-by-hour incident script with a tested backup at its center.On the Question Line: a board chair says, "We're a tiny nonprofit; nobody is going to bother hacking us," and we hand you the two-minute answer that wins the room. In the Tool Minute: Have I Been Pwned, the free breach check that makes the whole argument concrete in ninety seconds.Quick win: count your CMS administrator accounts, demote or delete the extras, and turn on 2FA for the rest.In This EpisodeThe four enemies: brute force, malware via update gaps, industrialized phishing, and form spam, plus the anatomy of a real small-site compromiseScope discipline as a security practice: the exotic threats to ignore, and the one setting that retires form spam for the yearThe baseline cost question: what would it cost to send the email that begins "We are writing to let you know about a security incident"?The phishing habit that survives perfect fakes, and the no-blame reporting norm that turns clicks into early warningsLeast privilege in practice: never fewer than two admins, no shared logins anywhere, and offboarding as a security eventWalls and alarms: two free layers, three settings, and the alert-fatigue tuning that keeps the rare message loudThe incident script: confirm, contain, rotate, restore onto an updated platform, and write the log entry that closes the loopMyth busted: "we're too small to be a target"The Question Line: the board chair's objection, answered in two minutes (send yours in via the link below)The Tool Minute: Have I Been PwnedLinksThis episode's worksheet, the Security Baseline Checklist and Incident Response One-Pager: https://webmanagers.com/registerEpisode page (full notes, worksheet, and transcript): https://webmanagers.com/podcast/security-for-non-security-peopleCapthca: Cap https://trycap.dev/ | hCapthca | Google reCAPTHCAHave I Been Pwned: haveibeenpwned.comThe book, Strategic Web Management: First Steps for the Accidental Web Manager: Companion site and all free worksheets: https://webmanagers.com/registerFollow the show: https://webmanagers.com/podcastLeave a rating and review: Apple Podcasts | Spotify URL | Other ChannelsAsk a question for a future episode: https://webmanagers.com/podcastTimestamps0:00 The bot that read a version number1:40 What this episode covers3:00 The Shift: automated, indiscriminate, and phishing without the tells4:50 The four enemies, and the threats you may ignore7:15 Anatomy of a small-site compromise8:25 The baseline: updates, credentials, 2FA, and the phishing habit10:55 Least privilege and the offboarding checklist12:10 Walls and alarms: two free layers, tuned rare14:25 The day you get hacked: the calm script17:25 Myth busted: "we're too small to be a target"18:25 The Question Line: the board chair's objection20:55 The Tool Minute: Have I Been Pwned22:10 Quick win: the administrator audit23:10 Worksheet and where to find it24:05 Close and Episode 10 tease
    続きを読む 一部表示
    26 分
  • Content Strategy and the Maintenance Calendar
    2026/10/13
    Last year, host Bryan Mills audited a client site whose homepage still read, "Coming in 2008. We'll see you soon!" On another project he found a pitch page for a co-founder who had left roughly fifteen years earlier, still pulling traffic, because Google never stopped sending people there. Both pages were live, working, and lying, and nobody knew.Content is not a launch event; it's a garden, and this episode gives the aging an owner. Bryan walks the content audit that hands every page one of four verdicts, keep, update, merge, or delete, with the one safety rule that turns deletion into pruning instead of vandalism: never remove a page with traffic or links without a 301 redirect to its closest living relative. Then governance sized for a two-person shop: the four-eyes rule, platform roles mapped to least privilege, and the burst-and-silence publishing cycle that tells visitors and search engines the enthusiasm collapsed. Then update policy as security policy, the weekly half hour called update Tuesday, and the episode's centerpiece: the maintenance calendar that gathers every cadence from the whole season into one owned, dated system costing three to five honest hours a month.On the Question Line: a client wants fifty AI-written blog posts to "fill out the site for SEO," and we make the smaller, better counter-offer. In the Tool Minute: Screaming Frog, the crawler that finds the pages your platform forgot.Quick win: find the three oldest pages among your most-visited in Search Console and update one this week.In This EpisodeThe content audit: four verdicts, two columns of evidence (last updated, traffic), and the five-check update pass that takes ten to twenty minutes per pageThe delete safety rule: check Search Console first, then a 301 redirect; pruning, not vandalismGovernance without bureaucracy: the four-eyes rule, least-role mapping, and why publishing should never require the account that can delete the siteThe burst-and-silence cycle, and sizing your publishing rhythm to your true capacityUpdate Tuesday: the fixed weekly sequence, auto-update versus manual by site criticality, and why an unapplied update is an advertised vulnerabilityThe maintenance calendar: weekly, monthly, quarterly, annual tiers, and the honest three-to-five-hours-a-month billMyth busted: "more pages = better SEO"The Question Line: fifty AI-written posts, declined with a better offer (send yours in via the link below)The Tool Minute: Screaming FrogLinksThis episode's worksheet, the Annual Web Maintenance Calendar and Content Audit Sheet and Google Search Console Set up SOP: wmg.dev/s/ep8Episode page (full notes, worksheet, and transcript): webmanagers.com/podcast/content-strategy-and-the-maintenance-calendarThe book, Strategic Web Management: First Steps for the Accidental Web Manager:Companion site and all free worksheets: WebManagers.comFollow the show: WebManagers.com/podcastLeave a rating and review: Apple Podcasts review | SpotifyAsk a question for a future episode: Call (800) 252-7957 or at the bottom of WebManagers.com/podcastTimestamps0:00 "Coming in 2008. We'll see you soon!"1:20 What this episode covers2:30 The Shift: AI made content cheap and credibility expensive4:05 The content audit and the four verdicts6:55 The delete rule and the five-check update pass8:30 Governance: four eyes, least roles, honest rhythm12:15 Update Tuesday and the auto-versus-manual decision rule13:40 The maintenance calendar and the honest time budget15:30 Myth busted: "more pages = better SEO"16:20 The Question Line: the fifty AI posts request18:35 The Tool Minute: Screaming Frog19:35 Quick win: update your oldest high-traffic page21:00 Worksheet and where to find it21:35 Close and Episode 9 tease
    続きを読む 一部表示
    23 分
  • Design, Mobile, and Accessibility Basics
    2026/10/06
    Around 2008, host Bryan Mills sat down with a nonprofit whose own board member could not use the organization's website: a screen reader met a site with no image descriptions and no way to reach the menu without a mouse. Nobody had locked him out on purpose. Nobody ever does it on purpose.That project is where accessibility stopped being a compliance word and became a person, and it drives this episode's claim: design, mobile, and accessibility are not talents. They're systems, and an accidental web manager can build all three.Bryan walks the one-page minimum viable brand kit that makes an organization look like one organization everywhere it appears, enforced by templates instead of policing. Then mobile, with the blunt conclusion the traffic forced: the phone version is not a version, it is the site, and a ten-minute walk with your own phone produces your design to-do list free of charge. Then the centerpiece: the eight accessibility fixes a careful non-designer can make from ordinary editing screens, why the same structure now feeds the AI systems deciding whether to cite you, and an honest warning about overlay widgets, the sticker over the lock that keeps showing up in lawsuits it promised to prevent.On the Question Line: a vendor quotes a zero-budget nonprofit board five hundred dollars a year for an overlay promising "full ADA compliance," and we script the honest counter-proposal. In the Tool Minute: the WebAIM Contrast Checker, pass-or-fail contrast answers in sixty seconds.Quick win: run your homepage through WAVE and fix every missing alt text it finds today.In This EpisodeThe minimum viable brand kit: one folder, one page, two fonts, four hex codes, and tone notes, enforced by making the consistent path the effortless oneMobile: readability, touch targets, thumb reach, and why the first screenful is the most valuable property on the siteThe cost question: if one in four of your visitors found the front door locked, how long would you leave it that way?The eight accessibility fixes: alt text, contrast, real headings, link text, keyboard operability, form labels, captions, and never letting color alone carry meaningWhy accessibility work now also serves AI visibility, ahead of Episode 10's GEO deep diveHiring help without getting fleeced: three green flags, three red flags, full contracting toolkit in Episode 16Myth busted: "accessibility is only for big companies"The Question Line: the $500 per year overlay widget pitch, dismantled (send yours in via the link below)The Tool Minute: WebAIM Contrast CheckerLinksEpisode page (full notes, worksheet, and transcript): webmanagers.com/podcast/design-mobile-and-accessibility-basicsWAVE accessibility scanner: wave.webaim.org | WebAIM Contrast Checker: webaim.org/resources/contrastcheckerThe book, Strategic Web Management: First Steps for the Accidental Web Manager: Companion site and all free worksheets: WebManagers.comFollow the show: WebManagers.com/podcastLeave a rating and review: Apple Podcasts review | SpotifyAsk a question for a future episode: Call (800) 252-7957 or at the bottom of WebManagers.com/podcastTimestamps0:00 The board member who couldn't use his own website1:30 What this episode covers2:20 The Shift: legal exposure meets machine readability4:40 The minimum viable brand kit6:50 The phone is the site: readability, touch targets, thumb reach7:50 The ten-minute phone test9:30 Accessibility: the cost question and the curb-cut reframe10:55 The eight fixes, one by one13:20 Hiring help: green flags and red flags14:00 Myth busted: "accessibility is only for big companies"15:10 The Question Line: the overlay widget pitch17:20 The Tool Minute: WebAIM Contrast Checker18:25 Quick win: WAVE your homepage, fix every alt text19:15 Worksheet and where to find it19:45 Close and Episode 8 tease
    続きを読む 一部表示
    21 分
  • Choosing Your Platform Without Regret
    2026/09/29

    Most "platform problems" are content, maintenance, or strategy problems wearing a disguise, and switching platforms moves the disguise, not the problem. The stale pages board the moving truck; the invoice runs four figures.

    Host Bryan Mills speaks from experience: he built more than five hundred client sites on a platform that no longer exists, and when Adobe shut down Business Catalyst, not one of his clients suffered an outage, because every site had a planned exit. That history drives this episode's central question, the one to ask of any platform pitch: what does it cost to leave?

    Bryan tours the big five, WordPress, Squarespace, Wix, Webflow, and Shopify, through the five axes that outlast every feature list: three-year cost, control, maintenance burden, lock-in, and commerce readiness. Then the honest math of build versus buy versus hire: a worked three-year total cost of ownership where the "free" platform lands at twice the cash cost of the subscription, and the line everyone wrongly zeroes out, your own hours. Finally, plugin maintenance debt and the four questions to ask before any install, plus the fix-extend-migrate decision tree that answers re-platforming enthusiasm with numbers instead of arguments.

    On the Question Line: a colleague insists the Wix site should move to WordPress "because that's what real businesses use," and the decision tree takes the question apart. In the Tool Minute: BuiltWith, the ninety-second lookup that tells you what any website runs on before you walk into a vendor meeting.

    Quick win: run your site through a free stack scanner and learn, in ninety seconds, exactly what your stack broadcasts to any curious outsider.

    In This Episode
    • The five evaluation axes that outlast every platform, including the AI site builders with no meaningful export at all
    • The big five in two families: open-source WordPress versus the hosted platforms, and why the maintenance axis quietly decides for accidental web managers
    • Build versus buy versus hire over three years: the worked TCO example, the hire path's hidden subscriptions, and pricing your own hours honestly
    • Plugin maintenance debt: the four questions at the door, the replaceability trap, and why deactivating is not removing
    • The fix-extend-migrate decision tree, and the meeting move that answers platform enthusiasm without spending political capital
    • Myth busted: "we need a custom-built site to look professional"
    • The Question Line: "real businesses use WordPress," dismantled branch by branch (send yours in via the link below)
    • The Tool Minute: BuiltWith, for scouting, verifying vendor claims, and seeing who migrated away from what

    Links
    • to be updated at launch

    Timestamps
    • 0:00 Switching moves the disguise, not the problem
    • 1:05 What this episode covers
    • 2:50 The Shift: five hundred sites on a platform that no longer exists
    • 3:55 The big five platforms and the five axes
    • 6:50 Finding out what you actually inherited
    • 7:30 Build versus buy versus hire: the three-year math
    • 9:55 Your hours are not free: the subsidy nobody budgets
    • 11:15 Plugin maintenance debt and the four questions at the door
    • 13:15 Fix, extend, or migrate: the decision tree and the meeting move
    • 14:25 Myth busted: "we need a custom-built site"
    • 15:50 The Question Line: "real businesses use WordPress"
    • 17:50 The Tool Minute: BuiltWith
    • 18:50 Quick win: the ninety-second stack scan
    • 19:40 Worksheet and where to find it
    • 20:25 Close and Episode 7 tease

    続きを読む 一部表示
    22 分
  • Hosting Without the Headaches
    2026/09/22

    How long can your website be down before it starts to cost you money? That question, not the feature list, is how to shop for hosting, and its twin is harder: if the site vanished this afternoon, how much recent work could you afford to lose forever?

    Host Bryan Mills walks the building your website actually lives in. First, the hosting landscape translated from marketing into situations: shared hosting as the apartment building, VPS as the townhouse, managed hosting as the full-service building that is often the best money in an accidental web manager's budget, and the two truths about hosting prices (the renewal rate is the real rate, and expensive does not mean reliable). Then the padlock: why SSL certificates should cost nothing, the five-minute verification most people never run, mixed content, and the industry's shift to dramatically shorter certificate lifespans.

    And then the hill Bryan is prepared to die on: backups. The 3-2-1 rule in plain terms, why the host's own backup can never be your only copy, and the quarterly restore test that turns a backup from a hope into a plan. Plus the free supporting cast, uptime monitoring, CDNs, staging, and how to tell a genuine reason to switch hosts from a mood.

    Two new standing segments debut this week. The Question Line takes on a classic: a board member offers to save $180 a year by moving the website to his nephew's server, and Bryan scripts the decline that doesn't insult anybody's nephew. And the Tool Minute covers Cloudflare's free tier, the CDN-plus-DNS combination that costs nothing and speeds up everything.

    Quick win: a free uptime monitor on your homepage, so you learn about the next outage from a notification instead of a customer.

    In This Episode
    • The four kinds of hosting matched to situations, not specifications, and why support quality outweighs every spec on the day something breaks
    • The renewal-rate trap: the advertised price is the introductory price, and the real monthly cost is the total paid divided by the months it covers
    • SSL/TLS verified in five minutes: the padlock, the forced https redirect, mixed content, and the coming 47-day certificate lifespan
    • The 3-2-1 backup rule, why host backups die with the host account, and the quarterly restore test with a dated, signed log
    • Uptime monitors, CDNs, and staging: the cheap layers, and which sites can honestly skip staging
    • Red flags versus false flags for switching hosts, and the drama-free migration procedure
    • Myth busted: "my host does backups, so I'm covered"
    • NEW, the Question Line: declining the nephew's server with a scorecard instead of a fight (send yours in via the link below)
    • NEW, the Tool Minute: Cloudflare's free tier, two tools in one account

    Links
    • This episode's worksheet, the Hosting Evaluation Scorecard and Backup Verification Log: wmg.dev/s/ep5
    • Episode page (full notes, worksheet, and transcript): webmanagers.com/podcast/episode-05-hosting-without-the-headaches
    • The book, Strategic Web Management: First Steps for the Accidental Web Manager: [book URL]
    • Companion site and all free worksheets: [companion-site URL]
    • Follow the show: [directory landing page URL]
    • Leave a rating and review: [Apple Podcasts review URL] | [Spotify URL]
    • Ask a question for a future episode: [question form or voicemail URL]

    Timestamps
    • 0:00 How long can you be down before it costs you money?
    • 1:30 What this episode covers
    • 3:05 The Shift: enterprise-grade is available to everyone; checked is still rare
    • 3:55 The hosting landscape by situation: shared, VPS, managed, cloud
    • 6:15 The two honest truths about hosting prices
    • 7:10 The padlock: verify, don't buy, and the shrinking certificate lifespan
    • 10:50 The hill: 3-2-1 backups and the quarterly restore test
    • 15:00 Uptime monitors, CDNs, staging, and when switching hosts is justified
    • 16:25 Myth busted: "my host does backups, so I'm covered"
    • 17:45 NEW, the Question Line: the board member's nephew has a server
    • 19:40 NEW, the Tool Minute: Cloudflare's free tier
    • 21:00 Quick win: the free uptime monitor
    • 21:45 Worksheet and where to find it
    • 22:45 Close and Episode 6 tease

    続きを読む 一部表示
    24 分
  • Domains: Your Most Important Digital Property
    2026/09/15

    A mismanaged domain takes down more than your website. It takes down your email, your trust signals, and your organization's public name, all in one stroke, and it can hand all three to a stranger. Host Bryan Mills has watched a Fortune 500 company spend thousands buying back its own name over a fifteen-dollar renewal.

    This episode makes you a competent holder of your organization's most important lease. Bryan separates the three different landlords, registrar, host, and DNS provider, so you always know which company to call; walks the expiration ramp stage by stage, from grace period to redemption fees to the drop-catchers who register lapsed names within seconds; and builds the layered renewal defense that takes less than an hour: auto-renew with a verified card, independent calendar reminders at 60, 30, and 7 days, multi-year runway, and registrar lock.

    Then DNS in plain English, using the only metaphor you need: your phone's contact cards. A, CNAME, MX, and TXT records each get one line and one job, including why email can break while the website works perfectly. Plus the honest math on defensive domain purchases, and the myth that "the web company owns the domain" is normal.

    Quick win: fifteen minutes to confirm your organization, not a person or a vendor, is the registrant of record.

    In This Episode
    • The three landlords: registrar (the leasing office), host (the building), DNS provider (the directory), and which one to call for each kind of outage
    • The expiration ramp: grace period, redemption fees, and the drop-catching services waiting at the bottom; the layered defense that prevents the whole ride
    • DNS without fear: A, CNAME, MX, and TXT records as contact cards, plus TTL, propagation, and the snapshot habit that makes every change reversible
    • The defensive registration decision rule: one or two domains, not fifteen
    • Transfers, WHOIS privacy, and recognizing an ownership dispute early
    • Myth busted: "my web company owns the domain; that's normal"

    Links
    • Updated on launch.

    Timestamps
    • 0:00 The Fortune 500 company that bought back its own name
    • 1:10 What this episode covers
    • 2:00 The Shift: domains became identity infrastructure
    • 3:05 The three landlords, and which one to call
    • 5:45 The expiration ramp, and what each day off the air costs
    • 7:10 The layered renewal defense, built in under an hour
    • 8:10 DNS in plain English: the four records and the contact-card metaphor
    • 11:15 Defensive registrations: the decision rule
    • 12:15 Myth busted: "the web company owns it; that's normal"
    • 13:35 Quick win: verify your registrant of record
    • 14:25 Worksheet and where to find it
    • 15:25 Close and next steps

    続きを読む 一部表示
    16 分
  • The Web Account Inventory: Do This First
    2026/09/08

    Nearly every web account audit finds the same three things: an orphaned account, an unknown auto-renewal, and an ex-employee who still has admin access. Every organization believes it's the exception. Almost none of them are.

    This is the episode host Bryan Mills would have you hear first: the web account inventory, the single register of everything your organization owns, rents, or depends on online, and the foundation every later episode runs against. Bryan walks the full discovery hunt, inbox archaeology, twelve months of card statements read aloud, DNS records as a witness list, and the website testifying against its own makers, then slows down for the number one trap of inherited web stacks: the difference between access, who can log in, and ownership, whose name and card the account is registered under. The two feel identical on a normal day and behave nothing alike on a bad one.

    The episode closes with where everything you find should live: a password manager instead of the shared spreadsheet, and the one-page "hit by a bus" file that makes your work survivable. The myth busted this week, "we know what we have," comes with a gift inside: the inventory usually pays for itself in canceled waste, and found money is how you sell the project to leadership.

    Quick win: twenty minutes searching the org inbox for "renewal," "invoice," and "verify your account." Expect at least one genuine surprise.

    In This Episode
    • What counts as a web account: the full perimeter, from domains and hosting to integrations, payment platforms, shadow accounts, and the fast-multiplying AI tool layer
    • The discovery hunt: inbox archaeology, statement descriptors and following the money, ICANN Lookup and DNS records as clues, page source and footer credits, and the exit interview worth booking
    • Access versus ownership: the vendor-owns-your-domain pattern, the audit columns to fill in, and the role-based address standard that survives every staff change
    • The password manager rollout that actually sticks, MFA custody, and the passphrase guidance for the vault's master password
    • The "hit by a bus" one-pager: what goes in it, what must never go in it, and the sealed-envelope problem
    • Myth busted: "we know what we have"

    Links
    • Updated with launch.

    Timestamps
    • 0:00 Introduction to Web Account Audtis
    • 1:10 What this episode covers
    • 1:50 The Shift: sprawl is the new normal
    • 3:15 Drawing the perimeter, and ranking what breaks
    • 5:50 The discovery hunt: inboxes, statements, DNS, and the website's own testimony
    • 10:20 Access versus ownership, and what it costs to get your domain back
    • 14:30 The password manager, the rollout, and MFA custody
    • 17:00 The "hit by a bus" one-pager
    • 16:00 Myth busted: "we know what we have," and the found-money reframe
    • 18:10 Quick win: three inbox searches, twenty minutes
    • 20:00 Worksheet and where to find it
    • 20:30 Close and Episode 4 tease

    続きを読む 一部表示
    22 分
  • Congratulations, You're the Web Manager Now
    2026/09/08

    "You're good with technology, right?" Six words in a hallway, and suddenly the website, the email, the domain, and a dozen mystery logins are yours. This episode is the job description nobody wrote down.

    Host Bryan Mills explains why the role lands on people by accident, and why the accidental path is the normal one: digital responsibilities pile up in organizations like boxes in a storage closet, and when the one person who understood the pile leaves, it flows downhill to whoever is nearest and most capable. Then the real job description in three duties: risk reduction, continuity, and steady improvement, along with what is deliberately not your job, no matter what the "good with technology" reputation attracts.

    The heart of the episode is the mindset that keeps web managers from burning out: strategist first, technician second, with the decide-delegate-automate framework for sorting every task that ever lands on your desk. Bryan also busts the myth that this arrangement is temporary; it almost never is, and owning the role strategically beats hosting it reluctantly.

    This week's quick win takes fifteen minutes: write the one-sentence version of your job description and send it to your boss or board for confirmation. The reply is your first piece of role documentation.

    In This Episode
    • How the role finds people: the storage closet effect, the four arrival paths, and the structural reason nobody hires for this job
    • The real job description: risk reduction, continuity, and steady improvement, plus the warm redirect for the broken-laptop requests that are not your job
    • Strategist first, technician second: the decide-delegate-automate framework, applied to a real website redesign
    • Automation is not abdication: the monthly log that keeps your automations honest
    • Myth busted: "this is temporary until we hire someone"
    • Quick win: the one-sentence job description, sent for confirmation

    Links
    • Updated on launch.

    Timestamps
    • 0:00 Introduction to Accidental Web Management
    • 1:20 What this episode covers
    • 2:03 Understanding the role of a web manager
    • 2:50 The Shift: a content job became a risk-management job
    • 3:35 How Bryan got the job in 1997, and how it finds everyone
    • 4:50 The real job description: risk, continuity, improvement
    • 6:10 What is not your job, and the warm redirect that protects the role
    • 10:55 Decide, delegate, automate, with a redesign as the worked example
    • 12:45 Automation is not abdication
    • 13:10 Myth busted: "this is temporary"
    • 14:20 Quick win: the one-sentence job description
    • 15:30 Worksheet and where to find it
    • 16:00 Close and Episode 3 tease

    続きを読む 一部表示
    17 分